Experimental realization of Counterfactual Quantum Cryptography 
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In counterfactual QKD information is transferee!, in a secure way, between Alice and Bob even 
when no particle carrying the information is in fact transmitted between them. In this letter we 
fully implement the scheme for counterfactual QKD proposed in [T. Noh, Phys. Rev. Lett. 103, 
230501 (2009)], demonstrating for the first time that information can be transmitted between two 
parties without the transmission of a carrier. 

PACS numbers: 03.67.Dd, 03.65.Ta, 03.67.Hk, 42.50.Ex, 42.50.St 
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Quantum Key Distribution (QKD) is a method for 
transmitting a secret key between two partners (usually 
named Alice and Bob) by exploiting quantum properties 
of light. The most important characteristic of this idea 
is that the secrecy of the generated key is guaranteed by 
the very laws of nature, i.e. by the properties of quan- 
tum states [ll, l2| . In the last decade QKD is moving from 
laboratories to become a mature technology for commer- 
cialization [3]; communications over more than 100 km 
having been achieved both in fiber [4] and open air [5]. 

However, beyond its commercial interest QKD repre- 
sents also a fruitful test bed of concepts and ideas blos- 
soming from quantum information theory and studies on 
foundations of quantum mechanics [l|, |2|, l6l-ll0| . 

In this sense a very interesting scheme was recently 
presented on this journal by Noh [11], who suggested a 
QKD protocol (usually called N09) where the informa- 
tion is transmitted, in a secure way, between Alice and 
Bob even when no particle carrying the information is in 
fact transmitted between them. In essence the scheme 
exploits a counterfactual measurement, for this reason it 
is also known as Counterfactual QKD (CQKD). 

The counterfactual measurement, which relies on fun- 
damental properties of quantum mechanics, is a typical 
example of interaction- free measurement that detects the 
state of an object without an interaction occurring be- 
tween it and the measuring device. One of the most 
widely known application of counterfactual measurement 
can be found in the Elitzur-Vaidman bomb-testing prob- 
lem [12], a well known thought experiment successfully 
experimentally implemented in the nineties [13]. 



CQKD [ll| challenges the usual paradigma requiring 
an effective transmission of a signal carrier (usually a 
photon) between the two parties exchanging information 
and therefore represents a very important conceptual de- 
velopment paving the way to further studies. 

In Ref. [14] a more efficient and complicated CQKD 
was proposed, whereas security issues of the N09 protocol 
were considered in Ref. [15|, where it was proved its un- 
conditional security by considering its equivalence to an 
entanglement distillation protocol. Finally, very recently, 
a security proof for intercept-resend attacks in realistic 
situation (non unit detector efficiency and presence of 



dark counts) was provided |16| . 

A first attempt to realize experimentally Noh's scheme 
is reported in Ref. jlTj. However, this set up missed 
the key element of CQKD, since the photon was indeed 
transmitted between Alice and Bob. 

In this letter we fully implement the N09 CQKD 
scheme, demonstrating for the first time that informa- 
tion can be transmitted between two parties without the 
transmission of an information carrier. 

To explain the principle of the proposed protocol, we 
describe an alternative version, absolutely equivalent to 
the original one [11], which is shown in Fig.l (a). 

Alice randomly rotates the single photon polarization 
(which originally is to be assumed horizontal) by means 
of a half wave plate (HWPA), either by (bit value "0") 
or by 7r/2 (bit value "1"). Then, the photon enters one 
port of a 50 : 50 beam splitter (BS), which is the first 
element of a Michelson interferometer. After BS, accord- 
ing to the polarization, the photon is in one of the two 
orthogonal states: 

\<Po) ={\0)A\H)B + i\H)A\0)B)/V2 (1) 

\<Pi) =mA\V)B+i\V)A\0)B)/V2 (2) 

The path A of the interferometer (containing an optical 
delay OD and a mirror) is inside Alice's sector, while 
path B reaches Bob's one. 

Bob randomly selects one of the two polarisations and 
detects the photon in this polarisation allowing the pho- 
ton in the complementary polarisation to fly back to Al- 
ice's site. This is achieved exploiting the HWPB and the 
Polarizing beam splitter (PBS). In particular, as the PBS 
addresses the \V) photon towards D2, while \H) photon 
is sent towards the mirror (M), rotations of the polariza- 
tion of and 7r/2 induced by the HWPB correspond to 
the detection of | V) and \H) photon state by D2. If the 
photon is not detected by D2 but reflected back by M it 
passes through the HWPB in the selected position, thus 
the photon gains back its original polarization state in- 
terfering with itself at BS at Alice's site and, for a proper 
tuning of the optical delay OD, it deterministically exits 
in DO. 

When Alice and Bob select complementary polariza- 
tion rotations, then either the photon is transmitted by 




FIG. 1: (a): scheme of the setup for Counterfactual QKD 
experiment equivalent to the one proposed by by Noh pj] ]. 
(b) Setup of the implemented version of the protocol. 



BS and detected by Bob at D2 with 50% probability 
(since its polarization at PBS is vertical), or it is reflected 
in path A and consequently detected by DO or Dl with 
equal probability (25%). 

After the detection is completed Alice and Bob can 
communicate each other whether or not each of the de- 
tectors clicked. If clicked either DO or D2, with the pur- 
pose of detecting the intervention of an eventual eaves- 
dropper, they announce both the detected and the initial 
polarization state. If Dl clicks Alice compares the ini- 
tial and final polarization states: if they are consistent 
she does not reveal any information, otherwise she an- 
nounces her result. Alice and Bob can then establish a 
common key by using only the events when the photon 
was detected at Dl with the correct polarization. 

The only apparent difference between the scheme dis- 
cussed here and the original proposal in Ref |ll| is in 
the apparatus used by Bob to detect the photon at D2. 
Nonetheless the one shown accomplishes exactly the same 
task, thus the two schemes should be considered abso- 
lutely equivalent. 

The very interesting point of this scheme is that the 
selection of events only at detector Dl correspond to pho- 
tons that have traveled path A, i.e. never exited Alice's 
sector. Therefore, the task of creating a secret key has 
been accomplished without any photon carrying the in- 
formation having been outside Alice's laboratory. 

In the following we present the results of our equiva- 
lent implementation of the protocol which is completely 
analogous to the one of Fig. 1(a), but it is based on a 
Mach-Zehnder interferometer instead of a Michelson in- 
terferometer. 

In our experimental set up, as shown in Fig. 1(b), 
a heralded single photon source exploiting parametric 
down-conversion (PDC) is used : a 100 mW laser emit- 



ting at 406 nm in continuous- wave regime pumps a type-I 
BBO crystal producing degenerate PDC at 812 nm. The 
emission of the PDC photons is slightly non-collinear cor- 
responding to an emission angle of approximately 3° with 
respect to the pump direction. The heralding photon af- 
ter passing through a 10 nm bandwidth interferential fil- 
ter and a 4 mm wide pinhole is coupled to a multi-mode 
fiber and addressed to the trigger detector. The her- 
alded photon, to be used as our true single photon state, 
is selected by an interferential filter (1 nm FWHM) and 
coupled to a single mode fiber leading to the input of the 
interferometer. 

The latter is a balanced Mach-Zehnder Interferome- 
ter (MZI) in which each arm has an adjustable trombone 
prism. One of the two arms is entirely included in Alice's 
site, while the other contains both the quantum channel 
and Bob's site, the latter being composed by a PBS be- 
tween two half-wave plates (HWPBl, HWPB2) and D2 
detector. 

The balance of the interferometer is guaranteed by a 
closed-loop piezo-electric movement system, which sta- 
bilizes the position of one of the trombones regulating the 
length difference between the two optical paths inside the 
MZI with nanometric resolution. 

The outputs of the interferometer, after spatial selec- 
tion via 1 mm diameter- wide irises, are then coupled in 
multi-mode fiber with no further spectral selection and 
all the signals (including the heralding photons and D2 
clicks) are revealed by Single Photon Avalanche Detec- 
tors (SPADs) with a ^ 60% detection efficiency at 812 
nm. 

Coincidence and time-tag analysis of the incoming sig- 
nals are performed by means of PicoQuant HydraHarp 
400 multichannel picosecond event timer. All the re- 
ported data were acquired in measurements of 20 sec- 
onds. Our results show good agreement with the theo- 
retical predictions and represent a proof of principle of 
the experimental feasibility of CQKD. 

In Fig. 2 interference fringes with high visibility can be 
observed in the coincidence counts between the herald- 
ing channel and each of the MZI output detectors DO and 
Dl as a function of the displacement of the prism balanc- 
ing the interferometer (within the coherence length of the 
signal, which, according to the filters used, is of the order 
of hundreds of jam) when Alice and Bob use compatible 
sets of polarization rotation angles {{Oa, Ob} = {0, 0} or 
{Oa^Ob} = {'7r/2,7r/2}). It can also be noticed that for 
this choice of angles the D2 counts are consistent with 
zero as expected. In particular, when no rotation at 
all is performed ({0,0}), the maximum visibilities are 
(92 ± 4)% for DO and (96 ± 4)% for Dl, while interfer- 
ence gets slightly spoiled for {7r/2,7r/2} where the vis- 
ibilities for DO and Dl are respectively (87 ±4)% and 
(91 ± 4)%, values which, nonetheless, are sufficient for 
the proof of the protocol. The uncertainty on the visibil- 
ities is obtained assuming a Poissonian distribution for 
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FIG. 3: Counting events showing the stabihty of the interfer- 
ometer in a half- an- hour long measurement when the balance 
of the two optical paths is fixed. 



of getting either a correct or an incorrect bit. In our case 
Bob gets an incorrect bit when Dl clicks even if Alice and 
Bob use the same angle of polarization rotations and the 
events related to the correct transmission are those in 
which Dl clicks when interference is destroyed. Further- 
more, we notice that when Alice and Bob use complemen- 
tary polarizations the amount of photons with the wrong 
polarization detected by Dl is effectively null when dark 
counts are subtracted. We can thus define QBER as 



FIG. 2: Coincidence counts between the heralding channel 
and each of the MZI output detectors DO, Dl and D2 in 20 
seconds acquisitions as a function of the displacement of the 
prism balancing the interferometer when Alice and Bob use 
compatible sets of angles (top figure: {0,0}; bottom figure: 
{7r/2, 7r/2}). For this choice of angles an interference pattern 
(with visibilities generally above 90%) can be observed in the 
DO and Dl counts and also control counts (D2) are consistent 
with zero as expected. 



the coincidence counts. Fig. 3 shows the stability of the 
interferometer in a half-an-hour long measurement when 
the balance of the two optical paths is fixed. 

The performances of our key distribution process are 
summarized in Table I. Corresponding to the angles 
{0,7r/2} and {7r/2,0}, Dl and DO counts are approxi- 
mately equal, as in this condition no interference should 
be present. These are the events relative to the actual 
transmission of information. In fact, the clicking of Dl 
delivers a bit of the secret key between the users even if 
no real photon travels in the quantum channel. 

In order to characterize the communication it is nec- 
essary to estimate the Quantum Bit Error Rate (QBER) 
defined as the ratio between the probability for Bob to 
register an incorrect bit and the sum of the probabilities 



QBER = 



Dl ,int 



Pdu 



Pdu 



(3) 



where PDi,int is the probability for Dl to register a pho- 
ton when Alice's and Bob's polarization rotations are 
equal, such that there is (destructive) interference, and 
PDi,nint IS the aualogous probability in the case in which 
Alice and Bob choose different angles. 

For our measurements the mean QBER is QBER = 
(12 ± 1)%. We underline that all the reported measure- 
ments are obtained without subtraction of background 
and accidental counts. If we account for these contri- 
butions, the corrected QBER value decreases noticeably 
to QBER' = (7 ± 1)%, as would be the case if more 
reliable detectors were used, such as detectors affected 
by a lower dark count rate. As already mentioned, the 
protocol has been demonstrated absolutely secure when 
ideal single photon sources are employed. To address the 
security problems eventually raised by the practical im- 
plementation of the protocol, firstly we tested it against 
possible photon-number-splitting attacks, i. e. we in- 
vestigated the quality of of our heralded single photon 
source. From the measured count rates we obtained a 
value of ^2(0) = (7 ± 5) * 10~^, which clearly shows neg- 
ligible presence of multi-photon components. The rea- 



son for such a small value is related to the very low 
level of count rates (180 maximum in 20 seconds acqui- 
sitions) at the detectors. This is basically due to the 
poor coupling efficiency of the heralded source (approx- 
imately 5%), the strict spectral selection on the herald- 
ing photons (1 nm FWHM filtering with 26% transmit- 
tance), and also because of the spatial selection at the 
interferometers output (we used irises as narrow as 1mm 
in diameter to optimize the visibility of the interference 
fringes). Furthermore, a small temporal detection win- 
dow (1 ns) was selected in correspondence of the arrival 
of the heralding photon. Because of this temporal post- 
selection we mention that unheralded photons may travel 
inside the channel and Eve may exploit that to get sig- 
nificant information by intercepting them. In order to 
overcome this security issue, shuttered heralded single- 
photon sources ^] should be considered a valuable solu- 
tion, as they present comparable performances with re- 
spect to the non-shuttered ones. Future developments of 
the scheme will include shuttered sources together with 
stabilized fiber interferometers for wider distance. 

We also address the issue of robustness of the protocol 
against more general attacks by computing the difference 
^^ = Iab — Iae^ where Iab (Iae) is the mutual informa- 
tion between Alice and Bob (Alice and Eve), in the cases 
of general Intercept-Resend attacks and "Time-Shift" at- 
tacks. Following the models suggested in Ref. [16|, one 
can express m for the intercept-resend attack as 



miR = Pdi[1 - h{ 



Pdi 



(4) 



where Pdi, Pel are respectively the click probability and 
the error probability at Dl and h{x) is the binary Shan- 
non Entropy. Regarding the time-shift attack, where Eve 
exploits the non-ideality of the detectors, one must sub- 
tract from the previous value two contributions, obtain- 



mg: 



rriTS = miR - 7 - AlAEiv)^ 



(5) 



where 7 accounts for the maximum corrupted bit rate 
due to dark counts and AIae{v) = ^^{Pd2 — Pe2) is 
the increment of the mutual information between A and 
E due to non-unit efficiency of the detectors. 

Both values calculated from the collected data are pos- 
itive {miR = 0.23 ± 0.04, tuts = 0.15 ± 0.06), ensuring 
the possibility of distributing a secret key [jj, \2\ 

Altogether our results provide a satisfying proof-of- 
principle of the QKD scheme realized in free-space. 
Nonetheless, recent results on the implementation of high 
stability fiber based Mach-Zehnder interferometers (over 
distances of the order of some km) [l8|, ll9| certify the pos- 
sibility of exploiting this protocol in "real-life" (as well 
as commercial) applications. 

In conclusion in this paper we have presented the 
first experimental demonstration of counterfactual QKD. 





{0,0} {0,^/2} W2,^/2} W2,0} 


Cdo 


180 it 4 59 ±2 159 ±4 59 db 2 


Cdi 


7.9 ±0.9 53 ±2 7.2 ±0.9 59 ± 2 


Cd2 


6.6 ±0.8 85 ±3 5.4 ±0.7 86 ± 3 


Vdo 


(92±4)% (0±4)% (0±4)% (87 ±4)% 


Vdi 


(96±4)% (0±4)% (0±4)% (91 ±4)% 


QBER 


(12 ±1)% 



TABLE I: Resume of the main results in the implementation 
of the CQKD protocol proposed in Ref. [Tl| . Each column 
refers to a set {Oa,Ob} of polarization rotation performed 
by the users and Cm labels the mean coincidence counts at 
the i-th detector in acquisition of 20 seconds. Vdo, Vdi are 
the visibilities of the interference fringes observed at the two 
outputs of the interferometer by scanning the path length 
difference between the two arms of the MZI. QBER is the 
estimated quantum bit error rate for the transmission . 



This result, beyond its eventual practical interest, has a 
huge conceptual significance since it demonstrates for the 
first time as information can be transmitted between two 
partners, thanks to quantum systems peculiar properties, 
in a situation where no carrier has been actually trans- 
mitted between them. 
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